Skip to main content
Panther Knowledge Base

What's the difference between the IPinfo enrichment providers in Panther?


Are there any differences in the IPinfo enrichment providers, for example, ipinfo_location vs ipinfo_location_datalake?


As mentioned on our documentation page, each table fulfills a different purpose:

The ipinfo_asn and ipinfo_location tables are used for real-time lookups in the detection engine, while the ipinfo_asn_datalake and ipinfo_location_datalake tables are used for querying and joining to IPinfo data in the datalake.